CVE-2026-86217
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. It affects an unknown function of the file /ht/hotel_db%20(1).sql in the Database Backup Handler component. The manipulation results in information disclosure. The attack can be launched remotely. The exploit is public and may be used.
Risk Assessment
Information disclosure may allow an attacker to access sensitive data such as customer or login information, potentially leading to further attacks.
Recommendation
Immediately remove or secure the database backup file and implement access controls on resources.
Other vulnerabilities in Hotel and Tourism Reservation
See all- CVE-2026-86216Medium
A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. It impacts an unknown function of the file /ht/details.php. Manipulation of the argument room leads to cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-14764High
A SQL injection vulnerability has been found in the Hotel and Tourism Reservation 1.0 system in the /admin/add_event.php file. An attacker can remotely manipulate the fdetails argument, leading to SQL injection.
- CVE-2026-14763High
A SQL injection vulnerability has been found in the Hotel and Tourism Reservation 1.0 system in the /admin/tour_reserves.php file. An attacker can remotely manipulate the tour argument, leading to SQL code injection. The exploit has been published and may be used.
- CVE-2026-14762High
A SQL Injection vulnerability was found in Hotel and Tourism Reservation 1.0 in the /admin/rooms.php file. An attacker can remotely manipulate the delete argument, leading to SQL injection. The exploit is publicly available.
- CVE-2026-14756High
A SQL injection vulnerability was found in the Hotel and Tourism Reservation 1.0 system in the file /admin/add_tour.php. Manipulation of the delete_image argument allows SQL injection. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-14755High
A SQL Injection vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0 in the file /admin/reservations.php. The unknown functionality of the Reservations Management Page allows manipulation of the delete argument, enabling remote SQL injection. The exploit has been publicly disclosed.
- CVE-2026-14754High
A SQL injection vulnerability has been found in Hotel and Tourism Reservation 1.0 in the file /admin/add_room.php. An attacker can remotely manipulate arguments delete_image, edit, description, number, price, rooms, or type, leading to unauthorized database access. The exploit has been published and may be used.
Original NVD description (English source)
A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hotel_db%20(1).sql of the component Database Backup Handler. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS